Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A cartoon intro to DNS over HTTPS

hacks.mozilla.org

Post reply on HN
Print view View original

51–60 of 137 posts

Re: A cartoon intro to DNS over HTTPS

#51

Post by mdellabitta »

iampims wrote: post #18
barbegal wrote: post #10

As a cynic I would say this is an attempt by Google and Cloudflare to collect DNS data. Why else would they provide this service for free? Both Google's [1] and Cloudflare's [2] DNS privacy policy prohibits them from storing personally identifiable information or from correlating DNS information with other Google data coming from the same IP/account but it does allow them to store information about which domains are…

For Google it makes sense. The faster you resolve DNS, the more webpages with ads you visit. Small price to pay to increase impressions.

DNS over HTTPS is actually a lot slower to resolve than traditional UDP DNS.

Re: A cartoon intro to DNS over HTTPS

#52

Post by tialaramex »

patrickmcmanus wrote: post #35
bobajeff wrote: post #31

>That means that your ISP can still figure out which sites you’re visiting, because it’s right there in the server name indication. Plus, the routers that pass that initial request from your browser to the web server can see that info too. Well there goes the interest I had in this.

we're coming after SNI too. One step at a time. (also, 1] dns leaks are worse than sni leaks as typically more people are exposed to the dns query and 2] HTTP/2 can carry more than one hostname on a connection so some hostnames that appear in dns are never leaked through sni.)

The TLS WG currently has only a problem statement for Encrypted SNI. Even the weak selection of two possible ways forward didn't achieve consensus as I understand it.

I don't see any way to have encrypted SNI without paying a price of one additional round trip. That's a fair price for something you must have, but for anybody to benefit we must insist everyone use it always, or adversaries will simply block it. And a round trip is a high price for users who don't (believe they) need this.

Re: A cartoon intro to DNS over HTTPS

#53

Post by gsich »

mdellabitta wrote: post #51
iampims wrote: post #18

Earlier quoted context omitted.

For Google it makes sense. The faster you resolve DNS, the more webpages with ads you visit. Small price to pay to increase impressions.

DNS over HTTPS is actually a lot slower to resolve than traditional UDP DNS.

Yes, but only because of TCP and TLS connection overhead.

Once the connection is established, response time is similar to UDP.

Re: A cartoon intro to DNS over HTTPS

#54

Post by caf »

gsich wrote: post #50
jedisct1 wrote: post #39

Earlier quoted context omitted.

Because DNS servers were never designed to keep many open TCP connections.

Doesn't matter what they were designed for. With TCP they need to behave that way. Otherwise this is a solution for people with latency I'll argue that the TCP and TLS handshake take more processing power then keeping the connection open.

The limiting resource with large numbers of idle sockets on the server side is memory, not processing power.

Re: A cartoon intro to DNS over HTTPS

#55

Post by pornel »

barbegal wrote: post #10

As a cynic I would say this is an attempt by Google and Cloudflare to collect DNS data. Why else would they provide this service for free? Both Google's [1] and Cloudflare's [2] DNS privacy policy prohibits them from storing personally identifiable information or from correlating DNS information with other Google data coming from the same IP/account but it does allow them to store information about which domains are…

> Why else would they provide this service for free?

Cloudflare runs the largest authoritative DNS server for their customers. The best way to make the DNS server faster is to make users query it directly.

For Cloudflare-hosted domains, instead of:

   User → ISP's DNS resolver → ns.cloudflare.com.
you get:

   User → [ 1111 → ns.cloudflare.com. ]
where the latter two are on the same machine.

Re: A cartoon intro to DNS over HTTPS

#56

Post by eridius »

jedisct1 wrote: post #38
nykolasz wrote: post #9

There are 3 major protocols available for DNS privacy: * DNSCrypt * DNS over TLS * DNS over HTTPS DNSCrypt is the one with better client support and a long list of providers available. If you pick DNS over TLS or DNS over HTTPS you will be restricted to 3 or 4 major players (google, quad9, cloudflare and cleanbrowsing). If you trust them, you are good. For example, this is the list of providers with DNSCrypt support:…

DNSCrypt is also the fastest and most secure. It doesn't require sessions (uses UDP by default, like regular DNS, but prevents amplification), enforces safe cryptography and pinned certificates, is trivial to implement, doesn't need OpenSSL, implements padding without inventing yet another DNS extension, and can use unique keys for each question (so that DNS providers can't fingerprint clients, unlike other options d…

If it's the fastest and most secure, why are people throwing their weight behind DNS-over-HTTPS? There must be a reason for it.

Re: A cartoon intro to DNS over HTTPS

#57

Post by T-hawk »

chipperyman573 wrote: post #48
iampims wrote: post #18

Earlier quoted context omitted.

For Google it makes sense. The faster you resolve DNS, the more webpages with ads you visit. Small price to pay to increase impressions.

DNS is not the bottleneck for page load speeds, especially now that 99% of the internet has images or video (even if the images are not a main focus of the webpage, such as a news article's image header)

Bandwidth bottleneck, no. Latency, time to first usable content on screen, absolutely.

Re: A cartoon intro to DNS over HTTPS

#58

Post by gsich »

caf wrote: post #54
gsich wrote: post #50

Earlier quoted context omitted.

Doesn't matter what they were designed for. With TCP they need to behave that way. Otherwise this is a solution for people with latency I'll argue that the TCP and TLS handshake take more processing power then keeping the connection open.

The limiting resource with large numbers of idle sockets on the server side is memory, not processing power.

Which I doubt is a problem for Cloudflare or Quad9. Anyway, a TCP based DNS service needs to consider those things. Otherwise it is becoming unusable due to very high response times.

A standard 8 GB system with Debian 9 gives me 1048576 max file descriptors. I am sure this can be optimized still.

Re: A cartoon intro to DNS over HTTPS

#59

Post by pornel »

Klathmon wrote: post #22
jchw wrote: post #11

Earlier quoted context omitted.

I don't think DNS-over-HTTPS precludes the use of DNSSEC - I think the intent is that eventually, you will in fact use both in tandem. DNSSEC alone would only give you the ability to check the integrity of a record, but DNS-over-HTTPS makes the transaction confidential and prevents third parties from censoring the request.

I guess I was just heading off the flurry of comments along the lines of "Why use DoH when we have DNSSEC?" that always seem to come up when discussing DoH.

DNSSEC has no encryption. It's not for privacy at all.

Re: A cartoon intro to DNS over HTTPS

#60

Post by gsich »

T-hawk wrote: post #57
chipperyman573 wrote: post #48

Earlier quoted context omitted.

DNS is not the bottleneck for page load speeds, especially now that 99% of the internet has images or video (even if the images are not a main focus of the webpage, such as a news article's image header)

Bandwidth bottleneck, no. Latency, time to first usable content on screen, absolutely.

Also consider that every shitty webpage needs to load ressources from a dozen other domains.
Post reply on HN